4

From Windows 7 admin account I've set up a scheduled task with max privileges that executes a .cmd file which executes

shutdown -s -f -t 120

if the user happens to be logged in and its past their allowed hours.

The user has only user rights but he still can cancel my Admin enforced shutdown by typing in Run box

shutdown -a. 

How do I prevent user from canceling and Admin issued shutdown? UAC is enabled. Thanks.

My final .cmd is this:

@echo off for /f "delims=" %%? in ('tasklist /v^| findstr /B /C:"explorer.exe"') do call :USERis %%? :USERis echo/%*|find "username">nul 2>&1&&(set "liet=username") echo/%*|find "Administrator">nul 2>&1&&(set "liet=Administrator") echo/%liet% if %liet%==username ( msg /server:localhost * /time:120 "Computer is shutting down in 2 minutes!" timeout /T 120 shutdown -s -f -t 0 -c "Computer is shutting down!" ) else ( echo Admin logged in! echo Do nothing exit ) exit

It is scheduled to run repeatedly every 3 minutes during 8 hour period when the PC should be off limits for user. So even if the PC is restarted it still gets a shutdown if User is logged in. Bios has setup password, time & date cannot be changed from user profile. Didn't check if BIOS boot menu works (to boot Linux and change time). Users are Linux dumb though.

  • Instead of setting up a scheduled task to run the shutdown command with a time-out period, why don't you create a scheduled task to shut down the computer when you want the computer to shut down? – Vinayak Aug 16 '14 at 22:10
3

This question has 2 different answers. One that directly answers your question, and one that is how you should be setting this up.

Solution to your question

You cannot prevent a user to abort a shutdown with a timer, but if you change the shutdown to -t 0 (immediate shutdown) it cannot be prevented with a shutdown -a command. You could therefor initiate a 2nd task that runs 2 minutes later that will do a shutdown -s -f -t 0 to shutdown the pc. The user will first see a timer of 2 minutes and even if they abort it, the system will shutdown 2 minutes later.

How you should solve this

Windows offers Parental Controls with logon hours. Setting this up will log the user out when the logon time has expired. Unlike with your solution, the user cannot simply turn on the pc and/or log back in. If they try to, they'll get a message: logon hours have expired. Wait until you are allowed to login again.

To set this up, do the following:

  1. Go to start -> Control Panel
  2. At the top right, Set View by to Category if this is not already done so.
  3. Click on Set up parental controls for any user.
  4. Click the user that you want to limit.
  5. Set Parental Controls to (x) On, enforce current settings
  6. Click Time limits
  7. Draw/fill the blocks where the user is not allowed to use the computer. You can use drag/drop from the top left corner to fill in a big area of blocks.
  8. Click on Ok to make this final.

Thats it. The user will be warned prior to being logged off.

  • Thanks, didn't know M$ had added something like that :) Anyways I used both options (my .cmd w/ 0 sec shutdown and parental controls). I'll see how they are doing and then maybe remove one. – DebianJunkie Aug 17 '14 at 19:36
  • Haven't tested, but it might also be possible to simply change the NTFS permissions on the shutdown command so that non-admins don't have access to the command. – Multiverse IT Aug 17 '14 at 21:46
  • @MultiverseIT Why would you want to reinvent the wheel if Microsoft already has this feature? – LPChip Aug 18 '14 at 6:59
  • A user should be able to shutdown the computer manually so changing ntfs permissions permanently wouldn't work. My thought was to rename shutdown.exe right after the 120s shutdown would be initiated and upon restart shutdown.exe.bak could be renamed back. I guess same could be done w/ changing permissions from command line. Didn't go that route though. – DebianJunkie Aug 18 '14 at 9:25
  • @DebianJunkie still, using Parental Controls is a far better solution. It will only log out that specific user, and on the logon screen is a shutdown button to power down the pc. The shutdown event will notify a user if another user is still logged in. – LPChip Aug 18 '14 at 10:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.